11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
user avatar
  • 11.4k
10 votes

Reverse Engineering of a packet encryption function of a game

First I would run some static analysis on the application such as Findcrypt or ProtectID and PEID's Kanal plugin to scan for known static values used in various encryption algorithms. If you find ...
user avatar
10 votes

What can I do with a SSH certificate?

I hope you recognized base64. The first few bytes in a hexadecimal dump are 30 82 04 a3 02 01 00 02 82 01 01 00 a2 9f 9e 9e 30 82 screams “ASN.1 DER” — 30 means “sequence”, 82 means “followed by a ...
user avatar
10 votes

ZTE encrypted backup config file

Updated for August 2020: The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing. The obfuscated section ...
user avatar
  • 246
9 votes
Accepted

Protect data stored in binary

I would start with not have critical strings in memory in linear manner Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got ...
user avatar
  • 1,374
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
user avatar
  • 11.4k
9 votes
Accepted

How do Enigma, Themida and VMProtect compare to each other?

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors ...
user avatar
  • 206
8 votes
Accepted

Finding the encryption key in a binary - IDA Pro and how an S-box might be represented in the binary

Initialization of the forward S-box As you probably saw in the source-code, the forward S-box is present several times and initialized at two different places. The first time that the forward S-box ...
user avatar
  • 8,629
7 votes

Decoding New Jersey Driver's License Codes

This is not yet a complete answer, but perhaps what I've found can be combined with other information to come up with the complete solution. First name encoding If we assume a linear encoding, then ...
user avatar
  • 2,416
7 votes
Accepted

Reversing encryption by analysing executable

There are typically many ways to start, and which one you want to use depends on your experience. Also, what works for one target might fail on another, and vice versa. What i'd start with is: Use ...
user avatar
6 votes

Protect data stored in binary

There are a number of ways to accomplish what you've stated. Generally, more robust techniques, while affording a higher level of protection, will also put more burden on the programmer creating the ...
user avatar
  • 2,416
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
user avatar
6 votes
Accepted

How can I identify how this string is being encoded so I can replicate it?

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
user avatar
  • 8,629
5 votes

What key is being using to encrypt the key transport in this Zigbee capture?

What is the profile being used? Home Automation (which is the one used by most devices) uses 'ZigBeeAlliance09' trust center link key to encrypt a random network key in the APS_CMD_KEY_TRANSPORT ...
user avatar
  • 151
5 votes

Decoding New Jersey Driver's License Codes

In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, ...
user avatar
  • 51
5 votes

Decoding New Jersey Driver's License Codes

I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (...
user avatar
5 votes
Accepted

AirPlay Mirroring decryption (FairPlay)

I have spent some time to look into Apple's airplay mirroring support, which is encrypted by fairplay protocol. After investigating serveral existing commercial applications I have finally managed to ...
user avatar
  • 66
5 votes
Accepted

Reimplementing the x86 AESENC instruction in python

Three problems: mix_column returns _col (typo underscore?) The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively ...
user avatar
  • 871
5 votes
Accepted

How to get file back from generated sha256 checksum?

This is actually one of the main attributes of Cryptographic Hash Functions. As mentioned in the wiki page, they are designed so they cannot be reversed: It is infeasible to generate a message from ...
user avatar
  • 11.4k
5 votes

Identification of AES portion code in binary

The best way to locate AES in a binary blob would be to locate first the AES S-box. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they ...
user avatar
  • 18.1k
4 votes

Decoding New Jersey Driver's License Codes

Many states use something called SoundEx to generate license numbers (sometimes you even see SoundEx on government forms and/or computer screens when they ask for drivers license numbers.) The ...
user avatar
4 votes
Accepted

Identify a decryption scheme

The first function (the one at .text:004D5A40) computes the 64-bit product of two 32-bit unsigned operands and stores the result through EAX. It is probably some half-assed 16-bit code recompiled with ...
user avatar
  • 1,960
4 votes

Declaring block as a string in IDA

I think the API you're looking for is idaapi.make_ascii_string(start, len, strtype) It's not really documented on https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html but ...
user avatar
4 votes

How to find compressed or encrypted parts in a packed executable?

A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can ...
user avatar
  • 1,814
4 votes
Accepted

Help deciphering binary that creates 3 passwords

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[...
user avatar
4 votes
Accepted

Having keys and binary, how do I reverse/decrypt a stream encryption?

Good news, You're lucky! What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
user avatar
  • 11.4k
4 votes

How can I identify how this string is being encoded so I can replicate it?

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x ...
user avatar
4 votes
Accepted

TP-Link encrypted backup file TX-VG1530

It seems they also added compression there. This utility seems to decode it: https://www.nirsoft.net/utils/router_password_recovery.html Also, I'd just written my own decoder and encoder for it: https:...
user avatar
  • 156
4 votes

Decrypting SQLite Database with key

There exists an official encryption addon for SQLite but from your description it sounds more like the data is simply stored encrypted in the blobs and the application decrypts it internally before ...
user avatar
  • 34.7k
3 votes

How to find compressed or encrypted parts in a packed executable?

For most packers out there: The start of the decompression or decryption is pretty much the entry point (with a bit of anti-debugging mixed in, perhaps). The end of the decompression or decryption ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible